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DETAILED ACTION 
Response to Arguments 

1. Applicant's arguments filed on 27 November 2006 with respect to claims 1-8, 10-12, 14- 
19, and 21-31 have been considered but are moot in view of the new groxmd(s) of rejection. 

Claim Objections 

2. Claims 10 and 11 are objected to xmder 37 CFR 1.75(c), as being of improper dependent 
form for failing to further limit the subject matter of a previous claim. Applicant is required to 
cancel the claim(s), or amend the claim(s) to place the claim(s) in proper dependent form, or 
rewrite the claim(s) in independent form. 

Claim 10 calls for a user selecting keys that are associated with the variables that 
correspond to the secure access code. This limitation is already required in claim 1 ("selecting, 
by a user, each key which corresponds to at least one of the variables of the secure access 
code"). 

Claim 11 calls for "wherein upon the successful verification of the secure access code, 
the user has access to a plurality of electronic services," which is already required in claim 1 
("allowing the user to access electronic services, if the values associated with the keys, as 
sequentially selected by the user, match the stored code"). 

3. Claim 24 is objected to because of the following informalities: The phrase "the 
combination of variables comprising at least two variables" is repeated twice. Appropriate 
correction is required. 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertciins. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Qaims 1-8, 10-12, 14-19, 22-24, and 28-31 are rejected under 35 U.S.C. 103(a) as being 
xinpatentable over Maddalozzo, Jr. et al. (US 6,434,702) in view of Morgan et al. (US 5,274,370). 

Referring to claims 1, 10, 11, 12, and 22-24, Maddalozzo teaches a method that provides 
security for a system using a virtual keypad (see Abstract). As called for in claims 1 and 22, 
Maddalozzo's method comprises (a) displaying a virtual keypad, which has a predetermined 
number (i.e., plurality, as called for in claim 22) of keys that enable a user to enter a password 
(i.e., secure access code), on a touchscreen surface (i.e., a graphical user interface, as called for in 
claim 22) (see Fig. 1, keypads 101-103; Fig. 2, keypads 102-103; Col. 2, lines 66-67; Col. 3, lines 1- 
34 and 66-67; and Col. 4, lines 1-4), as called for in claims 1 and 22; (b) associating one character 
(i.e., variable) with each individual key, wherein the characters are shuffled (i.e., one or more 
variables change) after each utilization or at different intervals (see Col. 3, lines 13-34 and 45-59; 
Col. 4, lines 49-67; and Col. 5, lines 23-27), as called for in claims 1 and 22; (c) associating 
different characters with different keys after each attempt to input a password (i.e., associating 
different variables with different key for different attempts to input the secure access code) (see 
Fig. 3, steps 308-309; CoL 3, lines 13-34 and 45-59; Col. 4, lines 49-67; and Col. 5, lines 23-27), as 
called for in claim 1; (d) a user selecting each key that corresponds to the character of the 
password (see Fig. 3, steps 301-306; Col. 3, lines 13-34; Col. 4, lines 14-49; and Col. 5, lines 4-22), 
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as called for in claims 1, 10, and 22; (e) comparing the characters associated with each selected 
key to the characters of the password with a code stored in a security code check mechanism's 
database (see Fig. 3, steps 305 and 306; Col. 4, lines 32-48; and Col. 5, lines 18-23), as called for in 
claim 1; and (f) allowing the user to access electronic services provided by the automatic teller 
machine (ATM) associated with the kej^ad if the characters associated with the keys, as 
sequentially selected by the user, match the stored code (see Fig. 3, step 307; Col. 1, lines 27-31; 
Col. 3, lines 13-15; Col. 4, lines 48- and 49; and Col. 5, lines 22-23), as called for in claims 1 and 
11. Regarding claim 12, as shown in Figs. 1 and 2, Maddalozzo's virtual keypad comprises (a) a 
static framework of virtual keys (i.e., a predetermined nxmiber of virtual keys) (see Figs. 1 and 2; 
Col. 3, lines 66-67; and Col. 4, lines 1-4); and (b) a predetermined character associated with each 
virtual key, wherein a user selects a virtual key based on whether the character associated with 
the virtual key matches the corresponding character in the user's password (i.e., access code) 
(see Fig. 3, steps 308 and 309; Col. 4, lines 32-63; and Col. 5, lines 23-27). Though the characters 
are assigned randomly after each access, the assignment of a character to a virtual key is 
xmderstood to be predetermined since the reshuffled characters are translated into a physical 
location, and a keypad code mechanism saves the new character configuration, which is then 
used during a new access attempt (see Col. 4, lines 31-56 and Col. 5, lines 23-27). Regarding 
claim 23, Maddalozzo teaches an ATM terminal (i.e., a secure access terminal) comprising (a) a 
touchscreen (i.e., graphical interface) that allows a user to access secured electronic information 
(see Col. 2, lines 66-67; Col. 3, lines 1 and 13-15; Col. 4, lines 44-49; and Col. 5, lines 18-23); and 
(b) a plurality of virtual keys displayed on tiie touchscreen, each virtual key associated with one 
character (i.e., variable), wherein different characters are associated with different keys after 
each attempt to input a password (see Figs. 1 and 2, virtual keypads 101, 102, and 103; Fig. 3, 
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steps 308-309; Col 3, lines 13-34, 45-59, and 66-67; Col. 4, lines 1-4 and 49-67; and Col. 5, lines 23- 
27). As called for in claims 22 and 23, Maddalozzo teaches creating a new look-up table that 
maps randomly arranged characters with their physical location at step 308 in Fig. 3 after each 
time the ATM has been accessed (see Col. 4, lines 35-48 and Col. 5, lines 4-11 and 23-27). 
Though Maddalozzo fails to disclose selecting the characters (i.e,, assigning a set of variables to 
the plurality of virtual keys, as called for in claim 23) from a predetermined set listed in a table 
containing all possible combinations of variables and virtual keys (as called for in claim 22) 
without any repetition of variables (as called for in claim 23), the Examiner takes Official Notice 
that the use of look-up tables is well known. Therefore, it would have been obvious to one of 
ordinary skill in the art at the time the invention was made to modify Maddalozzo's method 
and ATM such that the characters are selected from a predetermined set of combinations listed 
in a table containing all possible combinations of characters and virtual keys without any 
repetition of the characters because a look-up table containing all possible combinations of 
characters and virtual keys eliminates the need to create a new look-up table that maps 
randomly arranged characters with their physical location after each time the ATM has been 
accessed, thereby making the system more efficient. Regarding claim 24, Maddalozzo's method 
lacks the step of inserting a bank issued card into an ATM terminal to execute banking 
transactions. Maddalozzo's method, however, does include the step of a user entering his or 
her PIN into an ATM terminal (see Col. 1, lines 27-31 and Col. 3, lines 13-34), which occurs after 
a user inserts his or her ATM card into the ATM terminal; thus, Maddalozzo's method does 
include (a) a user inserting a bank issued card into an ATM terminal. Maddalozzo's method 
further includes (b) creating a virtual keyboard by assigning a character to each virtual key, 
wherein different characters are associated with different keys after each attempt to input a 
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password (i.e., a predetermined number of access attempts) (see Figs. 1 and 2, virtual keypads 
101, 102, and 103; Fig. 3, steps 308-309; Col. 3, lines 13-34, 45-59, and 66-67; Col. 4, lines 1-4 and 
49-67; and Col. 5, lines 23-27); (c) displaying the virtual keypad (see Fig. 3, step 309; and Col. 5, 
lines 23-27); and (d) requesting the access code be entered into the virtual keypad since 
Maddalozzo teaches a user knowing when to enter his or her password (see Col. 3, lines 19-22; 
Col. 4, lines 13-16, 32-34, and 53-59; and Col. 5, lines 4-23). 

Maddalozzo, however, fails to teach the following: (1) associating at least two variables 
with each individual key (as called for in claims 1, 12, and 22-24); and (2) associating different 
combinations of variables, each being different (i.e., not repetition), with different keys after 
each attempt to input a password (as called for in claims 1, 12, and 22-24). 

In an analogous art, Morgan's method comprises (a) providing five keys 68, 70, 72, and 
74 (i.e., a predetermined number of keys) used to input an access code (see Fig. 9 and CoL 8, 
lines 17-30); (b) associating two variables with each key (see Col. 8, lines 17-30 and 53-59); (c) 
randomly assigning digits 0 through 4 to the left displays 80, 82, 84, 86, and 88 and randomly 
assigning digits 5-9 to the right displays 90, 92, 94, 96, and 98 (i.e., associating different 
combination of variables with different keys) (see Col. 8, lines 53-59); (d) selecting, by a user, 
each key 68, 70, 72, or 74 that corresponds to one of the variables of the access code (see Col. 5, 
lines 46-48 and 57-60); (e) comparing the values associated with each selected key and with a 
code stored in a database (see Col. 5, lines 57-60); and (f) allowing the user access if the values 
associated with the selected keys, as sequentially selected by the user, match the stored code 
(see Col. 5, lines 57-60). Because Morgan teaches associating different variables with different 
keys after the system is turned on and for each new key entry of a full code (see Col. 4, lines 56- 
67 and Col. 5, lines 1-20), it is imderstood that digits 0 through 4 are randomly assigned to the 
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left displays 80, 82, 84, 86, and 88 and digits 5-9 are randomly assigned to the right displays 90, 
92, 94, 96, and 98 after each entry of a full code. In addition, each combination assigned to each 
key represents a different value (i.e., lacks repetition) since digits 0 through 4 are randomly 
assigned to the left displays 80, 82, 84, 86, and 88 and digits 5-9 are randomly assigned to the 
right displays 90, 92, 94, 96, and 98. 

Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to modify Maddalozzo's method, virtual keypad, and ATM as taught 
by Morgan because a virtual keypad having five keys and two characters assigned to each key 
provides high security by making it more difficult for an unauthorized person to observe and 
determine an authorized user's password (see Maddalozzo, Col. 1, lines 49-54; and Morgan, 
Col. 8, lines 49-66). 

Regarding claim 2, Maddalozzo and Morgan teach that alphanumeric characters are 
assigned to each key (see Maddalozzo, Col. 3, lines 15-17; and Morgan, Col. 9, lines 11-17). 

Regarding claims 3, 14, and 28, Maddalozzo and Morgan teach that numbers are 
assigned to each key (see Maddalozzo, Col. 4, lines 3-6; and Morgan, Col. 8, lines 27-30 and 53-. 
59). 

Regarding claims 4, 15, and 29, Maddalozzo and Morgan teach that letters are assigned 
to each key (see Maddalozzo, Col. 3, lines 15-17; and Morgan, CoL 9, lines 11-17). 

Regarding claims 5, 16, and 30, Maddalozzo and Morgan teach that a combination of 
letters and/ or numbers is assigned to each key (see Morgan, Col. 9, lines 11-17). 

Regarding claims 6, 17, and 31, Maddalozzo and Morgan teach that symbols are 
assigned to each key (see Maddalozzo, Col. 3, lines 15-17; and Morgan, Col. 9, lines 11-17). 
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Regarding claims 7 and 18, Maddalozzo, as modified by Morgan, teaches creating a new 
table of combinations and then displaying the new keypad after each access attempt or after 
every three access attempts (i.e., the predetermined number of access attempts) (see 
Maddalozzo, Col. 3, lines 45-47; Col. 4, lines 31-56; and Col. 5, lines 23-25). Though the 
characters are assigned randomly after each access, the assignment of the characters to a virtual 
key is xmderstood to be predetermined since the reshuffled characters are translated into a 
physical location, and a keypad code mechanism saves the new character configuration, which 
is then displayed used during a new access attempt (see Maddalozzo, Col. 4, lines 31-56 and 
Col. 5, lines 23-27). In other words, Maddalozzo and Morgan's combination of characters is 
generated by a sequence that is predetermined prior to the combination of characters being 
displayed and that changes after a predetermined number of access attempts. 

Regarding claims 8 and 19, as explained in the previous rejection of claim 7, Maddalozzo 
and Morgan's combination of characters is selected and then associated with the keys in 
accordance with a predetermined sequence of a combination of characters. Per Maddalozzo 
and Morgan, one combination of characters is displayed for each user (see Maddalozzo, Col. 4, 
lines 31-67 and Col. 5, lines 23-27; and Morgan, Col. 8, lines 53-59). 

6. Claim 21 is rejected xmder 35 U.S.C. 103(a) as being unpatentable over Jalili (US 
6,209,104) in view of Morgan et al. (US 5,274,370). 

Referring to claim 21, Jalili teaches a display device 104 displaying display image 250 
(see Figs. 4 and 5) comprising a group of icons io-in 230 (see Col. 6, lines 32-37). The group of 
icons iorin 230 forms a virtual keypad when display device 104 is a touchscreen device (see Col. 

7, lines 21-24). Jalili's virtual keypad comprises (a) icons iW„ 230 functioning as virtual keys for 
a user to enter a password and being displayed via display device 104 (i.e., a graphical 
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interface) in different arrangements and positions for each attempt at inputting information (see 
Col. 7, lines 7-14 and 21-24; and Col. 8, lines 22-32 and 46-49); and (b) a plurality of characters, 
each character associated with each icon io-in 230 (see Col. 6, lines 41-47; Col. 7, lines 21-24; and 
Col. 8, lines 21-32). Because Jalili teaches that server subsystem 200 generates a series of icons io- 
in 230 that include at least a user's password or personal identification number (PIN), wherein 
the icons' locations and features (i.e., character assigrunent) are (1) generated pseudo-randomly 
or according to a set scheme or (2) obtained from a filed, look-up table, database, etc. when a 
user identifies himself or herself (see Col. 8, lines 21-32), it is imderstood that different 
characters are associated with different icons after each access attempt. Jalili, however, is silent 
on associating at least two characters with each icon, wherein different character combinations 
are associated with each icon after each user's input attempt and each character in each 
combination represents a different value. 

In an analogous art, as explained in the previous rejection of claims 1, 12, and 22-24, 
Morgan's keypad comprises (a) five keys 68, 70, 72, and 74 (i.e., a plurality of keys) used to 
input an access code, each key associated with two characters (see Fig. 9 and Col. 8, lines 17-30 
and 53-59); and (b) a plurality of combinations associated with each key, wherein the 
combinations are determined by randomly assigning digits 0 through 4 to the left displays 80, 
82, 84, 86, and 88 and randomly assigning digits 5-9 to the right displays 90, 92, 94, 96, and 98 
(i.e., associating different combination of variables with different keys) (see Col. 8, lines 53-59). 
Because Morgan teaches associating different variables with different keys after the system is 
turned on and for each new key entry of a full code (see Col. 4, lines 56-67 and Col. 5, lines 1-20), 
it is understood that digits 0 through 4 are randomly assigned to the left displays 80, 82, 84, 86, 
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and 88 and digits 5-9 are randomly assigned to the right displays 90, 92, 94, 96, and 98 after each 
entry of a full code. 

Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to modify Jalili's virtual keypad as taught by Morgan because a virtual 
keypad having two characters assigned to each key provides high security by making it more 
difficult for an unauthorized person to observe and determine an authorized user's password 
(see Jalili, Col. 3, lines 61-67 and Col. 4, lines 1-5; and Morgan, Col. 8, lines 49-66). 
7. Claims 25 and 26 are rejected imder 35 U.S.C. 103(a) as being xmpatentable over 
Maddalozzo, Jr. et al. (US 6,434,702) in view of Morgan et al. (US 5,274^70) as applied to claim 
24 above, and further in view of Chasko et al. (US 6,715,078). 

Regarding claims 25 and 26, Maddalozzo, as modified by Morgan, teaches creating a 
new look-up table that maps randomly arranged characters with their physical location at step 
308 in Fig. 3 after each time the ATM has been accessed (see Maddalozzo, Col. 4, lines 35-48 and 
Col. 5, lines 4-11 and 23-27). Though Maddalozzo and Morgan fail to disclose selecting the 
characters from a predetermined set listed in a table containing all possible combinations of 
variables and virtual keys without any repetition of variables (as called for in claim 25), the 
Examiner takes Official Notice that the use of look-up tables is well known. Therefore, it would 
have been obvious to one of ordinary skill in the art at the time the invention was made to 
modify Maddalozzo and Morgan's method such that the characters are selected from a 
predetermined set of combinations listed in a table containing all possible combinations of 
characters and virtual keys without any repetition of the characters because a look-up table 
containing all possible combinations of characters and virtual keys eliminates the need to create 
a new look-up table that maps randomly arranged characters with their physical location after 
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each time the ATM has been accessed, thereby making the system more efficient Regarding 
claim 26, Maddalozzo and Morgan's method comprises (a) inputting a password (i.e., a 
personal access code) (see Maddalozzo, Col. 3, lines 19-22; Col. 4, lines 14-21 and 44-49; and Col. 
5, lines 4-23); (b) verifying the password (see Maddalozzo, Fig. 3, step 306; Col. 4, lines 44-49; 
and Col. 5, lines 11-23); and (c) allowing a user to access various banking transactions (see 
Maddalozzo, Fig. 3, step 307; Col. 4, lines 48-49; and Col. 5, lines 11-23). Maddalozzo and 
Morgan fail to expressly teach (1) transmitting card information to a server (as called for in 
claim 25); (2) verifying the authenticity of the bank-issued card (as called for in claim 25); and 
(3) encrypting data representing the password and transmitting the data to a server (as called 
for in claim 26). 

In an analogous art, Chasko's method comprises the steps of (a) inserting a bank-issued 
card into CTT lO's card clot 110 to execute a transaction (see Col. 1, lines 21-26 and 40-55; Col. 3, 
lines 2-5; Col. 4, lines 4-6; and Col. 5, lines 27-35); and (b) displaying PIN entry area 102 to a user 
(see Col. 2, lines 48-62). Because Chasko teaches that CTT lO's microprocessor 130 processes a 
user's PIN and controls the content of the information displayed on flat panel touch screen 101 
by using a standard ATM operating system and application program (see Col. 1, lines 21-26 and 
40-55; and Col. 5, lines 27-35), it is imderstood that a user enters his/her PIN upon seeing a PIN 
request displayed on flat panel touch screen 101. As shown in Fig. lA, PIN entry area 102 
includes a predetermined number of icons, each icon having at least one variable associated 
therewith. Though Chasko fails to expressly teach associating at least two variables with each 
icon (as called for in claims 24 and 27), wherein the at least two variables are alphanumeric 
characters (as called for in claim 30), Chasko clearly shows associating as many as four variables ' 
(e.g., "1, P, Q, R, S") with one icon. In addition, Chasko teaches that PIN entry area 102's layout 
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is predetermined during the programming design of the, screen layout (see Col. 5, lines 3-9). 
Regarding claim 25, Oiasko's metiiod includes the step of (a) determining which PIN entry area 
102 to display to the user, wherein PIN entry area 102 is determined during the programming 
design of the screen layout (see CoL 5, lines 3-13). Chasko teaches that CTT lO's microprocessor 
130 uses a standard ATM operating system and application program, wherein the ATM 
operating system and application program allow a user access to electronic services (such as 
cash withdrawals, funds transfer, and deposits) only if the user's PIN is valid to prevent 
imauthorized transactions; thus the authenticity of the card is verified prior to account access. 
Though Chasko's method does include the step of a user inserting a card into card clot 110 (see 
Col. 3, lines 2-4 and Col. 4, lines 4-6), Chasko omits expressly teaching the steps of transmitting 
the card information to a server. Since the applicant does not traverse the examiner's assertion 
of official notice that transmitting card information from an ATM to a server is well known, the 
well known in the art statement is taken to be admitted prior art. Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to modify 
Chasko's method such that the ATM transmits a user's card information to a server because 
such step eliminates each ATM having to store and maintain a large database of cxistomer 
accounts and provides a bank with centralized control of the system and database. Regarding 
claim 26, Chasko's method, as shown in Fig. 3, further comprises (a) a user entering a PIN at 
steps 302> 304, 308, 310, 314, and 318 (see Col. 6, lines 7-35); and (b) cryptographic smart card 
114 encrypting the PIN at step 320 (see CoL 6, hnes 35-42). Although Chasko omits expressly 
teaching that the user has access to a plurality of electronic services upon successful verification 
of the PIN, Chasko discloses tiiat CTT 10 is used witii ATMs and that CTT lO's microprocessor 
130 processes a user's PIN and controls the content of the information displayed on flat panel 
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touch screen 101 by using a standard ATM operating system and application program (see Col. 
1, lines 21-26 and 40-55; and Col. 5, lines 27-35). Standard ATM operating systems and 
application programs allow a user access to electronic services (such as cash withdrawals, f xmds 
transfer, and deposits) orUy if the user's PIN is valid to prevent imauthorized transactions. 

Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to modify the method of Maddalozzo and Morgan as taught by Chasko 
because a method comprising (1) transmitting card information to a server (as called for in 
claim 25); (2) verifying the authenticity of the bank-issued card (as called for in claim 25); and 
(3) encrypting data representing the password and transmitting the data to a server (as called 
for in claim 26) offers several advantages: (1) an ATM terminal that transmits a user's card 
information to a server eliminates each ATM terminal having to store and maintain a large 
database of customer accoimts and enables a bank to centrally control a plurality of ATM 
terminals; (2) security at an ATM terminal is further enhanced by requiring a user to provide a 
valid bank-issued card in addition to a password prior to accessing various banking 
transactions; and (3) the encryption of card information prior to transmission to the server 
makes it difficult for an unauthorized person to obtain an authorized user's password, thereby 
improving security of the ATM system. 

Conclusion 

8. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

> Lazzaro et al. (US 2003/0182558) teach a virtual keypad having virtual keys that are 
each assigned one or more alphanxuneric characters or symbols, wherein the 
characters or symbols are changed between each transaction or network session. 
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9. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until 
after the end of the THREE-MONTH shortened statutory period, then the shortened statutory 
period will expire on the date the advisory action is mailed, and any extension fee pursuant to 
37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

uu <rv WW 

Any inquiry concerning this commimication or earlier communications from tiie 
examiner should be directed to Clara Yang whose telephone number is (571) 272-3062, The 
examiner can normally be reached on Tuesdays, 1:00-2:00 PM. 

If attempts to reach the examiner by telephone are imsuccessful, the examiner's 
supervisor, Wendy Garber can be reached on (571) 272-7308. The fax phone number for tiie 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obteuned from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

CY 

30 January 2007 
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